Hello dear community
We are struggling with JIRA Azure Active Directory SSO for JIRA.
We used this official Tutorial to set it up.
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/jiramicrosoft-tutorial
Everything works good. Users can log in through AzureAD.
BUT
We are having problem, when we turn on "Force Azure Login" setting in this JIRA SSO app in configurations.
When we turn it on and then go to JIRA url, then we will be redirected to AzureAD log in page, which is good. We can log in succesfully, but when Administrator tries to go from Administration menu item for example to "Manage apps" page, then it shows for a split second that login is redirected to AzureAD, but then redirected back to Home Dashboard.
It's quite a problem since Adminsitrators can not access administration part when "Force Azure login" setting is turned on,.
We haven't figured out how we can fix that?! Anyone knows a solution for this problem?
Hi @Mart Lehtmets ,
In SAML SSO, IDP just sends the SAML Response and it is the responsibility of the SAML SSO plugin to create a user session (end-user session and WebSudo session) and it seems like you are using Microsoft's JIRA SAML SSO plugin, I suggest you check for an update or submit a support request to Microsoft for faster troubleshooting.
You can also take a look at the third-party plugins available on the Atlassian Marketplace which provides advanced features and updates directly from the Atlassian Marketplace.
Here is one of the SAML SSO plugins from miniOrange. It has a lot of advanced features that allow SSO to end-users as well as the JIRA Admin console. It also has an emergency URL to bypass SSO and allow login using the local JIRA credential and this URL can be configured in such way so that only administrator can use in case of emergency.
Thanks,
Lokesh
PS: I work for miniOrange one of the top SSO vendors in the Atlassian Marketplace. Feel free to reach out to miniOrange Support in case of any questions or need assistance with the plugin configuration.
Thank you for the recommendation. We went for the miniOrange one and it works like we need to. We can force Azure Login and admin portal works as well.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
the problem is this miniOrange addon is not free !
SAML SSO by Microsoft is free but is not working for the admin portal
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Thats was the whole reason why we ended up paying for the miniOrange add-on!
If Microsoft would put a little more effort into its add-on, we would be glad to switch back to it.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi @Lokesh Naktode_miniOrange I'm running a test on the plugin that you recommended and a question arose, how to remove the jira's default login screen and leave only the SSO redirect screen? Thank you.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hello,
This can be achieved by disabling the Delay Auto-Redirection to IDP option from the Sign In Settings tab of the plugin.
PS: I am a developer at miniOrange, a Top Atlassian SSO Vendor!
If you have any questions about it or would like to discuss it further, you can reach out to info@xecurify.com.
I hope this helps you!
Thanks,
Shweta.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Here is the solution for those searching for it : i found it here : https://confluence.atlassian.com/adminjiraserver/configuring-secure-administrator-sessions-938847890.html
Disabling secure administrator sessions
Secure administrator sessions (i.e. password confirmation before accessing administration functions) are enabled by default. If this causes issues for your Jira instance (e.g. if you are using a custom authentication mechanism), you can disable this feature by specifying the following line in your jira-config.properties file:
jira.websudo.is.disabled = true
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Have you find a way to fix this or you ended up to pay for using another plugin ?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Thanks for the head up, good to know, sadly this orange plugin is not free. I gave the solution below
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
I guess the token is missing the second time when it asks for authentication.
The solution here is to disable "Force Azure login" and have your primary authentication as SAML SSO, instead if you are using any other directory.
You may want to check the settings in SSO App you are configuring in Jira.
Now to troubleshoot the redirection problem, please see one of the links in the KB
Please analyze the logs in Jira.
Thanks,
Pramodh
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.